VPAT audit: how the testing behind an ACR works

A VPAT audit is the testing you do to fill in a VPAT: your product is checked against every criterion in the standard your buyer asked for, and the results become your Accessibility Conformance Report (ACR). Here is what a credible one involves, and how ours runs from quote to finished report.

VPAT audit or accessibility audit?

They overlap, but the goal differs. A general accessibility audit usually ends in a detailed fix list for your developers. A VPAT audit ends in a report your buyers read: one answer and one remark for every WCAG criterion (or every Section 508 or EN 301 549 clause), plus a description of how the testing was done. A good VPAT audit gives you the issue list as well, so you can fix things and update the report.

What a credible VPAT audit includes

Accessibility reviewers at universities and agencies read the Evaluation Methods section closely; the University of Vermont, for example, checks whether a report says who tested the product and how. (Our reports name Plain ACR as the evaluator, describe the manual review, and claim no certification.) They look for:

• A defined scope: which screens and user flows were tested, on which version, on which dates.
• Automated scanning of every screen in scope. Useful, but tools settle only some criteria; GSA's own testing guidance pairs automated tools with manual checks (section508.gov testing overview).
• Keyboard-only testing of every flow: can you reach and operate everything, and can you always see where focus is?
• Screen reader testing with a named screen reader and browser, such as NVDA with Firefox or VoiceOver with Safari.
• Zoom, reflow and text spacing checks at 200% zoom and at a 320 pixel wide viewport.
• Forms and errors: labels, instructions, error messages and status messages, triggered for real.
• A person's judgement on every row, written as a remark, not a pasted tool result.

Questions to ask any VPAT audit provider

• Will a person test with a keyboard and a screen reader, or is it a scan?
• Which screens and flows are in scope, and is the signed-in product included?
• Which VPAT edition and which WCAG version (2.1 or 2.2) will the report cover?
• Do we get the list of issues, not just the report?
• Is a retest included after we fix things, and what does it cost?
• Do they promise "compliance" or "certification"? No one can: ITI does not review or approve VPATs, and an ACR is your company's own statement about your product.

How our VPAT audit works

1. You request a quote

   Tell us the product, the edition you need and your deadline. If a buyer or a bid asked for the report, say which one, so the report fits what they want. We reply with a fixed price and a proposed scope, usually within one business day.

2. We agree the scope

   Together we list the screens and user flows to test (up to 15 for the standard price), usually the ones your buyers' users will touch most: sign-in, the main workflow, settings, help. You give us a test account or a staging link. The 5 business days start once we have access.

3. Automated first pass

   Scanners (axe-core, Pa11y, Lighthouse) and scripted checks run on every screen in scope: contrast, labels, headings, landmarks, keyboard order, focus visibility, zoom and reflow, text spacing. AI drafts a first remark for each success criterion from these results.

4. Manual testing and review of every row

   A person works through the product by keyboard only and with a screen reader, completes the forms, triggers the error and status messages, and checks the things no tool can judge: whether labels make sense, whether reading order matches meaning, whether alt text is useful. Then every row's conformance level and remark is reviewed and corrected by that person. Nothing goes in the report on a tool's word alone.

5. You get the report and the issue list

   You receive the ACR on ITI's VPAT® 2.5Rev template (Word and PDF), with the scope, dates and methods filled in, plus a list of the issues found with where they occur and how serious they are. You check the product details and publish it as your company's statement, or send it to your buyer.

Price and timing

1,490 USD for the WCAG edition (WCAG 2.2 Level A and AA), 1,990 USD for the Section 508, EU or INT edition, each covering up to 15 screens or key flows. Delivered in 5 business days. Bigger products, native mobile apps and desktop software get a fixed quote before any work starts.

What we need from you

• The product URL and a test account (or a staging copy) that reaches the screens in scope.
• The product's name and version, and a contact for accessibility questions to print in the report.
• If you have one, the buyer's request or bid wording, so we match the edition and standard they ask for.

Being open about AI

We use AI to run and summarise the automated checks and to draft remarks, because it makes the routine part fast. We do not let it decide. Our own trial on a live web app found that tools alone could settle only 5 of 56 rows; the rest needed a person to confirm or judge (see that draft). The report's "Evaluation methods" section lists exactly which tools and which manual tests were used.

Prefer to do it yourself? Use our free blank VPAT template and filling guide.